Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Technology Cybersecurity topic
No spam. Unsubscribe anytime.
District outlines data-minimization, MFA and identity-monitoring after PowerSchool breach
Summary
IT leaders told the board PowerSchool's December cybersecurity incident affected directory data only; the district does not store social-security numbers in PowerSchool and PowerSchool/Experian will offer free identity monitoring to affected users.
Erin Schilling, director of information technology, and Casey Smith, technology support specialist, briefed trustees on the district's technology and cybersecurity work and on a PowerSchool cybersecurity incident disclosed in December.
Schilling said the district's PowerSchool tables do not contain social-security numbers because the district practices data minimization; the data exposed in the incident were primarily directory fields (first and last name, addresses and similar directory information) rather than highly sensitive payroll or benefit identifiers. PowerSchool has offered to provide Experian identity and credit monitoring free to current students and staff, and the district said it will share instructions for enrollment with families and employees.
The information-technology team described several mitigation and governance steps: a cross-functional data-privacy team (IT, curriculum and instruction, instructional coaches) that vets third-party tools; the use of multi-factor authentication for staff accounts; phishing-awareness training and simulated phishing tests; and policies that minimize the personally identifiable information shared with third-party educational tools. Schilling said the vetting process sometimes results in teacher guidance such as using first name plus last initial when entering student identifiers into external tools.
The IT team also discussed operations: the district is examining whether some devices can safely be used beyond their typical four-year replacement cycle to reduce costs, and officials said they track application usage to identify underused, paid licenses.
'Our district does not house any social security numbers within PowerSchool,' Schilling said. 'That information is not necessary for DPI or our federal reports.' She said the district's data-minimization choices limited the sensitivity of the data exposed and that PowerSchool's offer of free monitoring goes beyond what the district itself needed to report.
The IT team characterized the work as ongoing and said the Future Ready and data-privacy teams will continue vetting tools, expanding accessibility supports, and offering professional development for staff.
